Trojan.MulDrop16.10501

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%ALLUSERSPROFILE%\Microsoft\Network\jlSXFRM9D7OI1SE6tplx7ADQV5VgUbZt3Pa5y9QO3KGpqjTh3EuQgta6GPuqT.exe" O 2>NUL'
[<HKLM>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%Low\Sun\Java\jre1.8.0_45_x64\rEcOWdOTTUp0vSZLxzoHtsPhwovDjgcfuP7styEbdicJCYcaZ4BaEZ1u2Tc2.exe" O 2>NUL'
[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\he\8ypoyfnQEPkwv5LnIoq.exe"...
[\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\ICQM\ICQ\html\de\loading\PUY8nOvCalv7ltlZElhZdKPf.exe" O 2>NUL'
[\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Mozilla\Firefox\Profiles\qlgVQb4UysHmQ1dscnR.exe" O 2>NUL'
[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%Low\Sun\Java\jre1.8.0_45_x64\hhiUVvkPb2HyCjUu.exe" O 2>NUL'
[<HKCU>_Classes\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\q7dywI5P9RBQWyGCcyPObSgLmFwuClFznAT6R.exe" O 2>NUL'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\Mail.Ru\Agent\Mra\smiles\smiles\animated\6mJvWH62ta2RVp0dwwISGNNjtJktPpRRoyieXXeIF0vrm7.exe" O 2>NUL'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%ALLUSERSPROFILE%\Microsoft\Windows NT\MSFax\Inbox\z5aVDSLkGfBrvnvJ8NIZtda1.exe" O'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Opera Software\Opera Stable\Cache\PNSl6UynQNnWiz6R6ZGUikWCDEOYguT8I2aJMxd3n7a.exe" O'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hr...
[\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0...
[\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%Low\Sun\Java\Deployment\cache\6.0\1\16DGgfT8WbzPBYhYXu6h4q2d76Eq7NMfWYKZvZwAfIALir...
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Microsoft\Windows Media\j6cYbLfU6sGpSyVNIgVtULAyJcv.exe" O'
[<HKCU>_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%HOMEPATH%\Music\6l7grUlj3JaUtvD1TITzLUn2KLkia.exe" O'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Microsoft\Internet Explorer\DOMStore\P4P79GG0\pm4CBdBg8oYB17oollh2c02KDLbfaFGf9AK...

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\package cache\vravvtzabu4p92htebu0iw8r1yq.exe
%LOCALAPPDATA%\microsoft\windows media\j6cyblfu6sgpsyvnigvtulayjcv.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\16dggft8wbzpbyhyxu6h4q2d76eq7nmfwykzvzwafialir2d3tv8fsxp29pc.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ar\6owevoceomj2smn2.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hr\aflyaz3vxwldo3jqzxtafjfxbsr7xvnyw8f2rfs.exe
%LOCALAPPDATA%\opera software\opera stable\cache\pnsl6uynqnnwiz6r6zguikwcdeoygut8i2ajmxd3n7a.exe
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\z5avdslkgfbrvnvj8niztda1.exe
%HOMEPATH%\music\6l7grulj3jautvd1titzlun2klkia.exe
%APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\6mjvwh62ta2rvp0dwwisgnnjtjktpprroyiexxeif0vrm7.exe
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\hhiuvvkpb2hycjuu.exe
%LOCALAPPDATA%\mozilla\firefox\profiles\qlgvqb4uyshmq1dscnr.exe
%APPDATA%\icqm\icq\html\de\loading\puy8novcalv7ltlzelhzdkpf.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\he\8ypoyfnqepkwv5lnioq.exe
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\recowdottup0vszlxzohtsphwovdjgcfup7styebdicjcycaz4baez1u2tc2.exe
%ALLUSERSPROFILE%\microsoft\network\jlsxfrm9d7oi1se6tplx7adqv5vgubzt3pa5y9qo3kgpqjth3euqgta6gpuqt.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\q7dywi5p9rbqwygccypobsglmfwuclfznat6r.exe
%LOCALAPPDATA%\microsoft\internet explorer\domstore\p4p79gg0\pm4cbdbg8oyb17oollh2c02kdlbfafgf9akfkj4zjeaipfp5fufovnp1buq.exe

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\package cache\vravvtzabu4p92htebu0iw8r1yq.exe
%LOCALAPPDATA%\microsoft\windows media\j6cyblfu6sgpsyvnigvtulayjcv.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\16dggft8wbzpbyhyxu6h4q2d76eq7nmfwykzvzwafialir2d3tv8fsxp29pc.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ar\6owevoceomj2smn2.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hr\aflyaz3vxwldo3jqzxtafjfxbsr7xvnyw8f2rfs.exe
%LOCALAPPDATA%\opera software\opera stable\cache\pnsl6uynqnnwiz6r6zguikwcdeoygut8i2ajmxd3n7a.exe
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\z5avdslkgfbrvnvj8niztda1.exe
%HOMEPATH%\music\6l7grulj3jautvd1titzlun2klkia.exe
%APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\6mjvwh62ta2rvp0dwwisgnnjtjktpprroyiexxeif0vrm7.exe
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\hhiuvvkpb2hycjuu.exe
%LOCALAPPDATA%\mozilla\firefox\profiles\qlgvqb4uyshmq1dscnr.exe
%APPDATA%\icqm\icq\html\de\loading\puy8novcalv7ltlzelhzdkpf.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\he\8ypoyfnqepkwv5lnioq.exe
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\recowdottup0vszlxzohtsphwovdjgcfup7styebdicjcycaz4baez1u2tc2.exe
%ALLUSERSPROFILE%\microsoft\network\jlsxfrm9d7oi1se6tplx7adqv5vgubzt3pa5y9qo3kgpqjth3euqgta6gpuqt.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\q7dywi5p9rbqwygccypobsglmfwuclfznat6r.exe
%LOCALAPPDATA%\microsoft\internet explorer\domstore\p4p79gg0\pm4cbdbg8oyb17oollh2c02kdlbfafgf9akfkj4zjeaipfp5fufovnp1buq.exe

Miscellaneous

Creates and executes the following

'%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\pmbfxhe1ahioxksa3rkpeu.exe' O
'%LOCALAPPDATA%\microsoft\windows media\j6cyblfu6sgpsyvnigvtulayjcv.exe' O

Executes the following